Splunk Search

Timecharts, distinct count and Total distinct count

jerwood
New Member

This may be simple, but I am pretty new to splunk in general and my attempts have not proved fruitful yet.

So I have a search returns a timechart of distinct users per State for an event, works fine. Timechart auto breaks it down which can be tuned, no problems there. What I want to do though, is add one final line to my timechart that is a "cumulative distinct count" for the search. The catch is, I want it to be a DC for the WHOLE timeframe, not just a sum of each dc timechart splits up into (aka addtotals col=t is not what I am looking for).

Any thoughts?

Tags (2)
0 Karma

jerwood
New Member

Edit: Here is the search string

index=cap type="AcctBadPswd" | geoip fromhost | search fromhost_country_name="United States"|timechart dc(user) by fromhost_region_name limit=55 usenull=0 useother=0

PS: I am having a TERRIBLE time with captchas on this site, worst ever... I can't edit my original post, always fails.

0 Karma

gfuente
Motivator

I think you are looking for

...| eventstats dc(users) | ...

Or something similar, please add your base search and sample events to get more information

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...